Terraform genesys_oauth_client secret in state file

Using the Genesys Cloud Terraform provider to manage OAuth clients. The secret argument is obviously required for the resource to apply, but it ends up in plaintext in the .tfstate file. We’ve tried using sensitive = true on the variable, but the state file still holds the raw value. Is there a way to reference a secret from AWS Secrets Manager without Terraform persisting the string in the state?